OpenTelemetry Javaagent RMI context propagation allows resource exhaustion
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-400.
Summary
OpenTelemetry Java Instrumentation provides OpenTelemetry auto-instrumentation and instrumentation libraries for Java. In versions prior to 2.27.0, the RMI context propagation payload reader limits the number of context entries but does not limit the aggregate size of the strings read from the stream. An attacker who can reach an RMI endpoint on an instrumented JVM can send an oversized context propagation payload. This can cause excessive memory allocation while the JVM reads the payload, potentially leading to denial of service. The issue affects only deployments where RMI instrumentation is enabled and an RMI endpoint is network-reachable. This issue has been fixed in version 2.27.0.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| open-telemetry | opentelemetry-java-instrumentation | before 2.27.0 | 2.27.0 | Patch available | CNA |
| — | io.opentelemetry.javaagent:opentelemetry-javaagent (Maven) | before 2.27.0 | 2.27.0 | Patch available | GHSA-fq3f-m5qm-99f5 |
- opentelemetry-java-instrumentation Vendoropen-telemetry Affected before 2.27.0 Fixed in 2.27.0 Patch available CNA
- io.opentelemetry.javaagent:opentelemetry-javaagent (Maven) Vendor— Affected before 2.27.0 Fixed in 2.27.0 Patch available GHSA-fq3f-m5qm-99f5
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:linuxfoundation:opentelemetry_instrumentation_for_java:*:*:*:*:*:*:*:* | 2.26.1 to before 2.27.0 | Vulnerable | backstage |
- cpe:2.3:a:linuxfoundation:opentelemetry_instrumentation_for_java:*:*:*:*:*:*:*:* Versions 2.26.1 to before 2.27.0 Vulnerable ·backstage
Remediation
- Fix · CNA opentelemetry-java-instrumentation (open-telemetry) Fixed in 2.27.0
- Fix · GHSA-fq3f-m5qm-99f5 io.opentelemetry.javaagent:opentelemetry-javaagent (Maven) Fixed in 2.27.0 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-54712
- 2026-10-03 Alias added: GHSA-fq3f-m5qm-99f5
References
Advisory 2
Other 4
- https://github.com/open-telemetry/opentelemetry-java-instrumentation/pull/17870
- https://github.com/open-telemetry/opentelemetry-java-instrumentation/commit/6ef18806d5daa4913619e4cb33d2d7ed6a853c22
- https://github.com/open-telemetry/opentelemetry-java-instrumentation
- https://github.com/open-telemetry/opentelemetry-java-instrumentation/releases/tag/v2.27.0
More open-telemetry vulnerabilities
- TI-2024-23957 OpenTelemetry Collector has a Denial of Service via Zip/Decompression Bomb sent over HTTP or gRPC CVSS 3.1HIGH 8.2
- TI-2026-42706 OpenTelemetry JavaScript: Denial of service in `JaegerPropagator` via unhandled exception on a malformed header CVSS 3.1HIGH 7.5
- TI-2026-33428 OpenTelemetry eBPF Instrumentation: Memcached payload length overflow can crash OBI CVSS 3.1HIGH 7.5
- TI-2026-33427 OpenTelemetry eBPF Instrumentation: MongoDB parser panics on malformed wire messages CVSS 3.1HIGH 7.5
- TI-2026-33420 OpenTelemetry eBPF Instrumentation: Postgres BIND parsing can panic on malformed payloads CVSS 3.1HIGH 7.5
- TI-2026-32777 opentelemetry-js: Prometheus exporter process crash via malformed HTTP request CVSS 3.1HIGH 7.5
Sources
- CVE-2026-54712 · CVE Program
- CVE-2026-54712 · NVD
- FIRST EPSS
- GHSA-fq3f-m5qm-99f5 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences